[BK7231N] Teardown and flashing of Atorch GR2P-WS: DIN rail device with graphic screen
Hello to all!
I recently bought this one for my collection, got it very cheap on sale, but the normal price is also good Link:
I found it interesting, compared to the other two similar devices I've been playing with (TOMPD63-WIFI and TOMPD63-LW because of the graphic screen. OTOH, it doesn't have residual current measurement (this version, at least, as we'll see later). Anyway, I don't think software-based RCBOs like those two should replace "conventional" (or this better kind of smart ones), because of safety reasons.
Ok, let's start with a print of the description from the advertisement (in case the link gets broken), enclosed as the first attachment. It includes a good gallery of screenshots from the device itself and the Tuya app, so I'll skip my own related photos. Also, here's a link to the manual from the manufacturer's page (also attached, in case the link breaks).
Now, the teardown gallery:
As we can see, it uses the CB2S WiFi module (datasheet), which employs BK7231N chip, so it is possible to flash OpenBeken on it.
As for the rest of main components, we can see them in the following image:
"1" (CH573F) is the Tuya MCU.
"2" (BL0942) is the AC metering chip
"3" (PN8016) is an unisolated DC/DC switch mode converter, to get 9V (presumably, as this is the relay's coil voltage) from the rectified AC (measured 10.1V).
"4" (marked HAHA A) is a switched mode regulator, to get (presumably) 3.3V (measured 3.23) from the previous 9V converter. This one feeds the Tuya MCU, the WiFi module, and the Power indicator LED. I couldn't find anything meaningful related to the markings but, from the peripheral components and connections could be similar to SY21031
or RT6200
"5" (marked 762A) is the bistable relay driver (Chinese datasheet)
Other main components are the relay and the TFT graphic screen (labeled GMT154-01, similar to this one).
Now, let's continue with the DpIDs identification. Following my tutorial, this is the result of "Query Things Data Model", once formatted and translated:
That means a total of 44 DpID's!! Let's put them in a more legible format:
(also attached as pdf)
After doing this with the original FW, we can now proceed to make a backup of it (attached) and then flash OBK. I tried first without isolating CB2S TX1 and RX1 signals from the main PCB, but got errors. I managed to isolate them without removing the module (just cleaning the solder bridge) and kept soldered Vcc and GND (CEN signal was already isolated). I have to say I had some problems trying to flash with bk7231flasher_1.3.3 (freezing at a certain point), so I finally did it with 1.1.6.
With so many DpIDs, this is still "work in progress". I've found some of them don't seem to work. Others, supposedly read-write, behave as read-only, etc. But the autoexec.bat at this moment is the following:
As you can see in some of the comments, this one is derived from the TOMPD63-LW's autoexec, which works well with @angel0fdeath web page for TOMPD63-WIFI, provisional adapted version. For this reason, and anticipating the possibility of adapting that web page also for this device, I've tried to keep the same channels for the same sensors.
These are screenshots of OBK's main screen and Home Assistant page for this device:
Everything seems to work fine (except for "strange" DpIDs) and I am able to properly command the relay, read network parameters, program values, etc.
And this is all for now. As there aren't enough channels to map all 44 DpIDs, I've been using channel 30 to test other DpIDs but still have to decide which of them will be chosen for the final mapping (as I said before, some of them don't work and others don't seem to have a real function). I'll keep you informed of the results!https://www.elektroda.com/rtvforum/posting.php?mode=editpost&p=21142057#
EDIT (18/07/24): I´ve been making some progress with the device, and I think I'm almost at the point of considering the work finished ("almost" because you can always find something to add/improve when dealing with this things...). So, the changes are:
1.- (almost) definitive autoexec.bat:
Also attached as GR2PWS_autoexec.bat_p.txt. I would recommend clearing all comments when copying to little FS to save space there.
This is the aspect of OBK's main page:
.
(the labels in these screenshots do not correspond with the autoexec, as it's a debug version that includes channel numbers and DpIDs to facilitate debugging)
And from Home Assistant's device page:
BTW, @pkaczmarek2 , in this page all the diagnostics sensors appear like "unknown", while in OBK's main page they have values. What could be the cause?
Also, I see there's no channel type for currency... Do you think it would be interesting to add a "generic currency" channel type? (I understand adding it for all the main currencies would mean too many types).
2.- Custom web page, modified from @angel0fdeath versions for the other devices cited before, attached as GR2PWS_rev3pr.html.txt. Heavily commented, so the original author can check/validate the mods, if he wants. I'd also clear all comments if loading it to little FS on the device, to avoid space problems.
Here is the screenshot of this custom web page:
One comment about this: The fault treatment in this device (DpID 132) is completely different than from the other two devices cited at the beginning, as in this one type is "enum", and in those it was "bitmap". The consequences are that in the other ones, several faults (overcurrent and overvoltage, for example) could be signaled at once, while in this device only one at a time, in the order of priority overvoltage-overcurrent-overpower-undervoltage-low prepaid energy-leakage" (if we have overcurrent and overvoltage, for example, it will show overvoltage and, once this disappears, then it'd show overcurrent, if still persisting).
3.- I've also updated the table of DpIDs with more info:
Also attached as .pdf (deleted previous one). If someone would like to have the original spreadsheet (.xlsx), just ask.
I´ve left a good amount of DpIDs out from the .bat (and .HTML), as there are not enough channels in OBK to accommodate all of them, nor they're really needed for normal remote operation. Also, although the necessary hardware is not implemented, for now, I've left the DpI'd related to the leakage current, as I've seen in the PCB that there's space left for the associated components, and I may give a try to install them and check if the TuyaMCU's firmware is prepared to read leakage current. To use the device as is, comment out or delete these lines in the .bat and .html.
Also, after writing my original post, I found there were already two posts about other Atorch products, with similar characteristics, especially the first one, but with some differences in DpIDs and functionality: AT4P(WP/BW) Smart Energy monitor, and S1-B/W/T/H Smart Socket Energy Monitor. The autoexec's posted there used only a small subset of the full range.
I see there have been no comments on this thread since I first posted it
... Anyway, I hope it can be of help to others who buy this interesting device, and I'll PM @gulson to see if he can put it in the devices list (I don't know if I can do it by myself)
Finally, many thanks to @pkaczmarek2 again for this fantastic software that gives so many possibilities to experiment with these devices!!
I recently bought this one for my collection, got it very cheap on sale, but the normal price is also good Link:
I found it interesting, compared to the other two similar devices I've been playing with (TOMPD63-WIFI and TOMPD63-LW because of the graphic screen. OTOH, it doesn't have residual current measurement (this version, at least, as we'll see later). Anyway, I don't think software-based RCBOs like those two should replace "conventional" (or this better kind of smart ones), because of safety reasons.
Ok, let's start with a print of the description from the advertisement (in case the link gets broken), enclosed as the first attachment. It includes a good gallery of screenshots from the device itself and the Tuya app, so I'll skip my own related photos. Also, here's a link to the manual from the manufacturer's page (also attached, in case the link breaks).
Now, the teardown gallery:
As we can see, it uses the CB2S WiFi module (datasheet), which employs BK7231N chip, so it is possible to flash OpenBeken on it.
As for the rest of main components, we can see them in the following image:
"1" (CH573F) is the Tuya MCU.
"2" (BL0942) is the AC metering chip
"3" (PN8016) is an unisolated DC/DC switch mode converter, to get 9V (presumably, as this is the relay's coil voltage) from the rectified AC (measured 10.1V).
"4" (marked HAHA A) is a switched mode regulator, to get (presumably) 3.3V (measured 3.23) from the previous 9V converter. This one feeds the Tuya MCU, the WiFi module, and the Power indicator LED. I couldn't find anything meaningful related to the markings but, from the peripheral components and connections could be similar to SY21031
or RT6200
"5" (marked 762A) is the bistable relay driver (Chinese datasheet)
Other main components are the relay and the TFT graphic screen (labeled GMT154-01, similar to this one).
Now, let's continue with the DpIDs identification. Following my tutorial, this is the result of "Query Things Data Model", once formatted and translated:
Code: JSON
That means a total of 44 DpID's!! Let's put them in a more legible format:
(also attached as pdf)
After doing this with the original FW, we can now proceed to make a backup of it (attached) and then flash OBK. I tried first without isolating CB2S TX1 and RX1 signals from the main PCB, but got errors. I managed to isolate them without removing the module (just cleaning the solder bridge) and kept soldered Vcc and GND (CEN signal was already isolated). I have to say I had some problems trying to flash with bk7231flasher_1.3.3 (freezing at a certain point), so I finally did it with 1.1.6.
With so many DpIDs, this is still "work in progress". I've found some of them don't seem to work. Others, supposedly read-write, behave as read-only, etc. But the autoexec.bat at this moment is the following:
Code: Javascript
As you can see in some of the comments, this one is derived from the TOMPD63-LW's autoexec, which works well with @angel0fdeath web page for TOMPD63-WIFI, provisional adapted version. For this reason, and anticipating the possibility of adapting that web page also for this device, I've tried to keep the same channels for the same sensors.
These are screenshots of OBK's main screen and Home Assistant page for this device:
Everything seems to work fine (except for "strange" DpIDs) and I am able to properly command the relay, read network parameters, program values, etc.
And this is all for now. As there aren't enough channels to map all 44 DpIDs, I've been using channel 30 to test other DpIDs but still have to decide which of them will be chosen for the final mapping (as I said before, some of them don't work and others don't seem to have a real function). I'll keep you informed of the results!https://www.elektroda.com/rtvforum/posting.php?mode=editpost&p=21142057#
EDIT (18/07/24): I´ve been making some progress with the device, and I think I'm almost at the point of considering the work finished ("almost" because you can always find something to add/improve when dealing with this things...). So, the changes are:
1.- (almost) definitive autoexec.bat:
Code: Javascript
Also attached as GR2PWS_autoexec.bat_p.txt. I would recommend clearing all comments when copying to little FS to save space there.
This is the aspect of OBK's main page:
.
(the labels in these screenshots do not correspond with the autoexec, as it's a debug version that includes channel numbers and DpIDs to facilitate debugging)
And from Home Assistant's device page:
BTW, @pkaczmarek2 , in this page all the diagnostics sensors appear like "unknown", while in OBK's main page they have values. What could be the cause?
Also, I see there's no channel type for currency... Do you think it would be interesting to add a "generic currency" channel type? (I understand adding it for all the main currencies would mean too many types).
2.- Custom web page, modified from @angel0fdeath versions for the other devices cited before, attached as GR2PWS_rev3pr.html.txt. Heavily commented, so the original author can check/validate the mods, if he wants. I'd also clear all comments if loading it to little FS on the device, to avoid space problems.
Here is the screenshot of this custom web page:
One comment about this: The fault treatment in this device (DpID 132) is completely different than from the other two devices cited at the beginning, as in this one type is "enum", and in those it was "bitmap". The consequences are that in the other ones, several faults (overcurrent and overvoltage, for example) could be signaled at once, while in this device only one at a time, in the order of priority overvoltage-overcurrent-overpower-undervoltage-low prepaid energy-leakage" (if we have overcurrent and overvoltage, for example, it will show overvoltage and, once this disappears, then it'd show overcurrent, if still persisting).
3.- I've also updated the table of DpIDs with more info:
Also attached as .pdf (deleted previous one). If someone would like to have the original spreadsheet (.xlsx), just ask.
I´ve left a good amount of DpIDs out from the .bat (and .HTML), as there are not enough channels in OBK to accommodate all of them, nor they're really needed for normal remote operation. Also, although the necessary hardware is not implemented, for now, I've left the DpI'd related to the leakage current, as I've seen in the PCB that there's space left for the associated components, and I may give a try to install them and check if the TuyaMCU's firmware is prepared to read leakage current. To use the device as is, comment out or delete these lines in the .bat and .html.
Also, after writing my original post, I found there were already two posts about other Atorch products, with similar characteristics, especially the first one, but with some differences in DpIDs and functionality: AT4P(WP/BW) Smart Energy monitor, and S1-B/W/T/H Smart Socket Energy Monitor. The autoexec's posted there used only a small subset of the full range.
I see there have been no comments on this thread since I first posted it
... Anyway, I hope it can be of help to others who buy this interesting device, and I'll PM @gulson to see if he can put it in the devices list (I don't know if I can do it by myself)
Finally, many thanks to @pkaczmarek2 again for this fantastic software that gives so many possibilities to experiment with these devices!!
morgan_flint wrote 248 posts with
rating 56 , helped 4 times.
Live in city Sevilla.
Been with us since 2018 year.
Comments
Wonder if I could get some help getting my Atorch GR2PWS units reprogrammed to remove Tuya calling home? I have connected to the wifi module that has the BK7231N chip. I downloaded the original firmware... [Read more]
AFAIK, this is normal with Tuya MCU devices, as this one. Did you include this information with "Change OBK settings for flash write"? I usually do it by accessing the device's access point, which... [Read more]
Hello Morgan, First, thank for the reply and help. I am still having issues. If I flash the .bin file you have attached, GR2PWS_Reset_BK7231N_QIO_2024-23-6-20-54-08, the device does not connect to my wifi.... [Read more]
That bin is a backup of the original FW, posted it in case someone has problems and wants to go back to Tuya, or for experts here to analyze it for other features. To get the device going with OpenBeken,... [Read more]
Ok, have my head on straight now, mostly... Have programmed four units and all report the following in home assistant: sensor.obk_87fb00029_current sensor.obk_87fb00029_voltage sensor.obk_87fb00029_power sensor.obk_87fb00029_total_energy sensor.obk_87fb00029_frequency_hz sensor.obk_87fb00029_power_factor sensor.obk_87fb00029_temperature... [Read more]
I'm having the same problem with OBK "internal" sensors (see the first attached image), although the values show up on OBK's main web page (second image). This also happens to me with some other devices,... [Read more]
here's the MCU binary downloaded when accepting the 1.0.3 update offered by the Tuya app for this device https://obrazki.elektroda.pl/2839948500_1731158725_thumb.jpg [Read more]
Thanks! How can you install it in the MCU if you have flashed OBK? [Read more]
That I do not know. Not yet anyway. [Read more]
and hang on. How has this not been added to the device list yet? https://github.com/OpenBekenIOT/webapp/pull/159 [Read more]
Thanks for adding it, I don't have very clear the procedure to do that Added after 2 [minutes]: I Imagine I can flash the Tuya FW back from the backup, update the MCU FW from there and then go back... [Read more]
indeed. who knows if the changes in these MCU updates warrant the effort though. [Read more]
I imagine it would be necessary to implement this in OBK to be able to update MCU FW via OTA, but probably, it's not worth the effort, I think MCU FW updates are not so common for these devices. BTW,... [Read more]
Hi. I have two of those devices. I'm happy to find this discussion and people were able to reflash and manage this device directly from HA. I want to reflash my device too and have question about MCU... [Read more]
Hello. I have found how to activate the Diagnostic data (actual RSSI, IP, SSID and others ) are reported to HA via MOTT topics. (mentioned in earlier messages) We can just enable those states report... [Read more]
Super Cool! Just installed today and everything is working just fine!!! [Read more]
For those that are interested in the update mechanism for MCU side it is document in code here https://github.com/tuya/tuya-wifi-mcu-sdk-arduino-library/blob/b7f5018b27c9b63888d720ac910b0c181d766986/src/TuyaDefs.h#L81 and... [Read more]
cool. do you know if your MCUs on the AT4Ps are already at 1.0.9 or still earlier? ref https://github.com/divadiow/TuyaMCUBins/tree/main/OTA [Read more]
AT4P 1.0.4 , AT4PW 1.0.7 ,AT4PBW 1.0.6 are what i have on hand working devices but not dumped MCU wise, i do have the BK side though darkspr1te Added after 4 [minutes]: Oh and i compared the... [Read more]